CVE-2017-12160 in KeyCloak
Сводка (Английский)
It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Резервировать
01.08.2017
Раскрытие
26.10.2017
Статус
Подтверждённый
Записи
VulDB provides additional information and datapoints for this CVE:
| ИД | Уязвимость | CWE | Экс | Кон | CVE |
|---|---|---|---|---|---|
| 108633 | KeyCloak Oauth слабая аутентификация | 287 | Не определено | Официальное исправление | CVE-2017-12160 |